CVE-2026-1415: Gpac Use After Free Vulnerability

CVE-2026-1415 Overview

A null pointer dereference vulnerability was identified in GPAC versions up to 2.4.0. The vulnerability affects the function gf_media_export_webvtt_metadata in the file src/media_tools/media_export.c. Manipulation of the Name argument leads to a null pointer dereference condition, which can cause the application to crash. This vulnerability requires local access to exploit, and proof-of-concept exploit code has been reported as publicly available.

Critical Impact

Local attackers with low privileges can trigger a denial of service condition in GPAC by exploiting the null pointer dereference in the WebVTT metadata export functionality, potentially disrupting media processing workflows.

Affected Products

• GPAC versions up to and including 2.4.0
• Systems utilizing GPAC's WebVTT metadata export functionality
• Applications built on the GPAC multimedia framework

Discovery Timeline

• 2026-01-26 - CVE-2026-1415 published to NVD
• 2026-01-28 - Last updated in NVD database

Technical Details for CVE-2026-1415

Vulnerability Analysis

This vulnerability is classified as a null pointer dereference (CWE-476) with an associated improper resource shutdown or release issue (CWE-404). The flaw exists within the gf_media_export_webvtt_metadata function, which is responsible for exporting WebVTT metadata from media files. When processing certain media tracks, the function fails to validate whether the lang and handler pointers returned by gf_isom_get_media_language and gf_isom_get_handler_name are valid before dereferencing them.

The vulnerability requires local access and low privileges to exploit. An attacker must have the ability to provide a specially crafted media file to the GPAC application. When processed, the malformed input causes the vulnerable function to attempt operations on null pointers, resulting in a denial of service condition.

Root Cause

The root cause of CVE-2026-1415 is insufficient null pointer validation in the WebVTT metadata export code path. The original code unconditionally passed the lang and handler variables to gf_fprintf after retrieving them from helper functions, without first checking whether these pointers were valid. When these functions return null pointers (which can occur with certain media file configurations), the subsequent operations trigger the null pointer dereference.

Attack Vector

Exploitation of this vulnerability requires local access to a system running GPAC. The attacker must be able to supply a malicious media file that, when processed by GPAC's WebVTT metadata export functionality, triggers the null pointer dereference. The attack scenario involves:

1. Crafting a media file that causes gf_isom_get_media_language or gf_isom_get_handler_name to return null
2. Convincing a user or automated process to export WebVTT metadata from this file
3. The null pointer dereference causes a denial of service

The patch demonstrates the fix by adding proper null checks before using the returned values:

 	gf_fprintf(vtt, "WEBVTT Metadata track generated by GPAC MP4Box %s\n", gf_sys_is_test_mode() ? "" : gf_gpac_version());
 
 	gf_fprintf(vtt, "kind:metadata\n");
-	{
-		char *lang;
-		gf_isom_get_media_language(dumper->file, track, &lang);
+
+	char *lang;
+	gf_isom_get_media_language(dumper->file, track, &lang);
+	if (lang) {
 		gf_fprintf(vtt, "language:%s\n", lang);
 		gf_free(lang);
 	}
-	{
-		const char *handler;
-		gf_isom_get_handler_name(dumper->file, track, &handler);
+
+	const char *handler;
+	gf_isom_get_handler_name(dumper->file, track, &handler);
+	if (handler)
 		gf_fprintf(vtt, "label: %s\n", handler);
-	}
+
 	if (gf_isom_is_track_in_root_od(dumper->file, track)) gf_fprintf(vtt, "inRootOD: yes\n");
 	gf_fprintf(vtt, "trackID: %d\n", dumper->trackID);
 	if (med) {

Source: GitHub Commit Reference

Detection Methods for CVE-2026-1415

Indicators of Compromise

• Unexpected GPAC application crashes during WebVTT metadata export operations
• Core dump files generated by GPAC processes with null pointer access in gf_media_export_webvtt_metadata
• Repeated failures in media processing pipelines utilizing GPAC's MP4Box utility
• Suspicious media files with unusual track metadata configurations in upload directories

Detection Strategies

• Monitor for SIGSEGV signals from GPAC processes, particularly in the media_export.c code path
• Implement file integrity monitoring on GPAC binaries to ensure patched versions are deployed
• Review media file uploads for malformed track metadata that could trigger the vulnerability
• Deploy application crash monitoring that flags null pointer dereferences in GPAC components

Monitoring Recommendations

• Enable core dump collection for GPAC processes to analyze crash patterns
• Implement logging around WebVTT export operations to identify problematic input files
• Set up alerts for abnormal GPAC process terminations in production environments
• Monitor system resource usage for signs of repeated crash-restart cycles

How to Mitigate CVE-2026-1415

Immediate Actions Required

• Update GPAC to a version containing the security patch (commit af951b892dfbaaa38336ba2eba6d6a42c25810fd or later)
• Review and validate all media files processed by GPAC before export operations
• Implement input validation for media files in automated processing pipelines
• Restrict access to GPAC utilities to authorized users only

Patch Information

A patch has been released that addresses this vulnerability. The fix adds proper null pointer validation before using the return values from gf_isom_get_media_language and gf_isom_get_handler_name. The patch identifier is af951b892dfbaaa38336ba2eba6d6a42c25810fd. Organizations should deploy the patched version of GPAC to remediate this vulnerability. Additional details are available in the GitHub Issue Tracker and the GitHub Commit Reference.

Workarounds

• Avoid using WebVTT metadata export functionality on untrusted media files until patched
• Implement sandboxing or containerization for GPAC processes to limit impact of crashes
• Add pre-processing validation to filter potentially malicious media files before GPAC processing
• Run GPAC operations in isolated environments with process restart capabilities

# Configuration example
# Build GPAC from source with the security patch applied
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout af951b892dfbaaa38336ba2eba6d6a42c25810fd
./configure
make
sudo make install